--- title: The AppSec Career Nobody Trained You For | OWASP Bay Area April 2026 | AppSecAI description: Slides, resources, and the GRASP framework from Bruce Fram's OWASP Bay Area talk on April 16, 2026. Download the slide deck, GRASP evaluation handout, and AI skill. --- [![Logo. Blue. Horizontal](https://www.appsecai.io/hubfs/Logo.%20Blue.%20Horizontal.svg "Logo. Blue. Horizontal")](https://www.appsecai.io) - Open submenu for Products - [Expert Fix Automation](https://www.appsecai.io/expert-fix-automation) - [Expert Triage Automation](https://www.appsecai.io/expert-triage-automation-eta) - Open submenu for By Role - [Application Security Teams](https://www.appsecai.io/application-security-teams) - [Product Security](https://www.appsecai.io/product-security) - [CISOs](https://www.appsecai.io/application-security-for-cisos) - [Vulnerability Management](https://www.appsecai.io/vulnerability-management) - [Engineering Leaders](https://www.appsecai.io/engineering-security-automation) - Open submenu for Resources - [Blog](https://www.appsecai.io/blog) - [Case Studies](https://www.appsecai.io/case-studies) - [AppSec - Complete Guide in AI Era](https://www.appsecai.io/application_security_complete_guide) - [Videos & Podcasts](https://www.appsecai.io/videos-podcasts) - [Return on Investment Calculator](https://www.appsecai.io/roi) - [Performance Metrics](https://www.appsecai.io/performance-metrics) - [AI Security Book](https://www.appsecai.io/the-ai-security-advantage-by-bruce-fram) - [Partners](https://www.appsecai.io/partners) - [Pricing](https://www.appsecai.io/pricing) - [About](https://www.appsecai.io/about) Show submenu for About - [Leadership Team](https://www.appsecai.io/about#leadership) - Open submenu for Products - [Expert Fix Automation](https://www.appsecai.io/expert-fix-automation) - [Expert Triage Automation](https://www.appsecai.io/expert-triage-automation-eta) - Open submenu for By Role - [Application Security Teams](https://www.appsecai.io/application-security-teams) - [Product Security](https://www.appsecai.io/product-security) - [CISOs](https://www.appsecai.io/application-security-for-cisos) - [Vulnerability Management](https://www.appsecai.io/vulnerability-management) - [Engineering Leaders](https://www.appsecai.io/engineering-security-automation) - Open submenu for Resources - [Blog](https://www.appsecai.io/blog) - [Case Studies](https://www.appsecai.io/case-studies) - [AppSec - Complete Guide in AI Era](https://www.appsecai.io/application_security_complete_guide) - [Videos & Podcasts](https://www.appsecai.io/videos-podcasts) - [Return on Investment Calculator](https://www.appsecai.io/roi) - [Performance Metrics](https://www.appsecai.io/performance-metrics) - [AI Security Book](https://www.appsecai.io/the-ai-security-advantage-by-bruce-fram) - [Partners](https://www.appsecai.io/partners) - [Pricing](https://www.appsecai.io/pricing) - [About](https://www.appsecai.io/about) Show submenu for About - [Leadership Team](https://www.appsecai.io/about#leadership) - [Demo Video](https://www.appsecai.io/demo) - [Schedule Demo](https://calendly.com/brucefram/30min) - [Demo Video](https://www.appsecai.io/demo) - [Schedule Demo](https://calendly.com/brucefram/30min) OWASP Bay Area • April 16, 2026 # The AppSec Career Nobody Trained You For **Bruce Fram** · CEO, AppSecAI Slides, resources, and the GRASP framework from the April 16 talk ## What This Talk Was About In 18 months your title might stay the same, but your actual job will be unrecognizable. AI is about to mass-produce both vulnerabilities and fixes faster than any human can review them. The people who figure out how to manage that pipeline will run application security. Everyone else will be writing Jira tickets for an LLM. This talk covered why the CEO and board suddenly care about AppSec (because software failures can now collapse the economy), what happens when developers stop writing code and start prompting for it, and why the industry's 11-step manual process will never close the gap. We looked at the **"Vulnpocalypse"** — the reality that the industry finds problems but nobody fixes them — and what the new operating model looks like when you shift from security engineer to automation manager. Attendees left with the **GRASP framework** for evaluating whether an AI project is enterprise-ready, a worked example scoring a real open-source project, and a clear picture of the skills that will matter most in the next two years. ## The GRASP Framework Five pillars to evaluate the enterprise-readiness of any AI project G Governance Who controls it, what are the rules, and what does it cost? R Reliability Does the system stay up and produce consistent results? A Assurance Are outputs accurate, relevant, and solving the right problem? S Scalability Can it handle the full workload, not just a pilot? P Protection Is your data safe, and do you trust the providers? The goal isn't a perfect 25 — it's matching the score to the risk and purpose of the project. ## Downloads & Resources Everything from the April 16 talk — slides, handouts, and tools ### [📄 Slide Deck The full presentation from the OWASP Bay Area talk. PDF Download](https://www.appsecai.io/hubfs/OWASP%20Bay%20Area/owasp-bay-area-april-2026_v5.pdf) ### [📋 GRASP Evaluation Handout Printable 2-sided reference card with pillar definitions and evaluation matrix. PDF Download](https://www.appsecai.io/hubfs/OWASP%20Bay%20Area/grasp-handout-print.pdf) ### [📝 Session Notes & Transcript A detailed summary of key talk points and the full session transcript. PDF Download](https://www.appsecai.io/hubfs/OWASP%20Bay%20Area/OWASP%20Bay%20Area%20%E2%80%94%20Your%20Time%20Is%20HERE%20_%20Session%20Notes.pdf) ### [🤖 GRASP AI Skill An AI coding assistant skill that implements GRASP evaluation. Drop it into your workflow to run assessments on any project. ZIP Download](https://www.appsecai.io/hubfs/OWASP%20Bay%20Area/grasp-evaluation-skill-vdot8.zip) ### [📖 The AI Security Advantage: Fix Code 10X Faster The book by Bruce Fram. Attendees receive a free copy. Free for Attendees](https://www.appsecai.io/the-ai-security-advantage-by-bruce-fram) ### [📰 Chris Hughes — "Vulnpocalypse: AI, Open Source, and the Vulnerability Explosion" The Resilient Cyber article referenced in the talk about why the industry finds problems but nobody fixes them. External Article](https://www.resilientcyber.io/p/vulnpocalypse-ai-open-source-and) ## Project OASIS An open-source initiative vetting AI-generated fixes for 1,000+ SAST findings across open source projects. [Join Project OASIS →](https://www.owasp-oasis.org/) ## Speaker ![Bruce Fram](https://www.appsecai.io/hubfs/Team/Bruce%20Fram.jpg) ### Bruce Fram CEO, AppSecAI · Founding CEO, Contrast Security Bruce has run six enterprise software companies over 25+ years of technology shifts. He's more technical than most CEOs — he codes with AI daily — and recently wrote *The AI Security Advantage: Fix Code 10X Faster*. [LinkedIn ↗](https://www.linkedin.com/in/brucefram) [appsecai.io ↗](https://www.appsecai.io) [![Logo. White. Horizontal](https://www.appsecai.io/hubfs/Logo.%20White.%20Horizontal.svg "Logo. White. Horizontal")](https://www.appsecai.io/) **Automation for Application Security Teams** - Products - [Expert Fix Automation (EFA)](https://www.appsecai.io/expert-fix-automation) - [Expert Triage Automation (ETA)](https://www.appsecai.io/expert-triage-automation-eta) - [Try Now!](https://www.appsecai.io/try-now) - By Role - [Application Security Teams](https://www.appsecai.io/application-security-teams) - [Product Security](https://www.appsecai.io/product-security) - [Vulnerability Management](https://www.appsecai.io/vulnerability-management) - [CISOs](https://www.appsecai.io/application-security-for-cisos) - [Engineering Leaders](https://www.appsecai.io/engineering-security-automation) - Resources - [Blog](https://www.appsecai.io/blog) - [Case Studies](https://www.appsecai.io/case-studies) - [Videos & Podcasts](https://www.appsecai.io/videos-podcasts) - [AI Security Book](https://www.appsecai.io/the-ai-security-advantage-by-bruce-fram) - [Metrics](https://www.appsecai.io/performance-metrics) - [ROI Calculator](https://www.appsecai.io/roi) - [Pricing](https://www.appsecai.io/pricing) - Company - [About](https://www.appsecai.io/about) - [Partners](https://www.appsecai.io/partners) - [Careers](https://www.appsecai.io/careers) - [Contact Us](https://www.appsecai.io/contact) - [Privacy Policy](https://www.appsecai.io/privacy-policy) - [Terms of Service](https://www.appsecai.io/terms-of-service) - [Cookie Policy](https://www.appsecai.io/cookie-policy) --- © 2026 AppSecAI, Inc. All rights reserved. ```json { "@context" : "https://schema.org", "@id" : "https://www.appsecai.io/#org", "@type" : "Organization", "contactPoint" : [ { "@type" : "ContactPoint", "availableLanguage" : [ "en" ], "contactType" : "sales", "email" : "automation@appsecai.io" }, { "@type" : "ContactPoint", "availableLanguage" : [ "en" ], "contactType" : "security", "email" : "security@appsecai.io" }, { "@type" : "ContactPoint", "availableLanguage" : [ "en" ], "contactType" : "privacy", "email" : "privacy@appsecai.io" } ], "logo" : { "@type" : "ImageObject", "height" : 112, "url" : "https://43994771.fs1.hubspotusercontent-na2.net/hubfs/43994771/Logos/Logo.%20Blue.%20Stacked-1.png", "width" : 112 }, "name" : "AppSecAI, Inc.", "sameAs" : [ "https://www.linkedin.com/company/appsecai-inc/", "https://www.youtube.com/@AppSecAI" ], "url" : "https://www.appsecai.io/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.appsecai.io/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "AppSecAI", "publisher" : { "@id" : "https://www.appsecai.io/#org" }, "url" : "https://www.appsecai.io/" } ```